Cloud of virtual clouds for increasing isolation among execution domains

ABSTRACT

A system and an article of manufacture for providing a cloud environment for provisioning a guest virtual machine instance include selecting at least one machine from a collection of machines as a management node, wherein the at least one machine includes a hypervisor enabled with nested virtualization capability, deploying a plurality of cloud managers on each management node, selecting at least one machine from the collection of machines as a host node, deploying a plurality of level two hypervisors on each host node, forming a plurality of virtual clouds, wherein each virtual cloud contains at least one of the plurality of cloud managers and one of the plurality of level two hypervisors, and provisioning, via the at least one cloud manager, at least one guest virtual machine instance on top of the at least one level two hypervisors.

FIELD OF THE INVENTION

Embodiments of the invention generally relate to information technology,and, more particularly, to cloud computing.

BACKGROUND

In existing cloud computing models, all virtual machine (VM) instancesrun in a single shared execution domain. The same host operating system(OS) and hypervisor stack is used across the cloud. Meanwhile, the guestsystems, containing a guest OS and application, are under full controlof cloud users. A single cloud manager handles VM provisioning,migration, and de-provisioning operations. Computing resources,including central processing unit (CPU) and memory, are typicallyover-committed across all VM instances. This has created severalproblems.

For example, due to the complexity, frequent updates and closeinteractions with cloud and web users, guest systems and cloud managersare highly vulnerable to external attacks. Also, a single attack couldpenetrate all hypervisors, which are of the same type, and compromisethe entire cloud. Additionally, malicious code can propagate in thecloud through shared resources. Further, resource over-commitment causesperformance degradations and uncertainties to individual applications.

SUMMARY

In one aspect of the present invention, techniques for providing a cloudof virtual clouds (CVC) for increasing isolation among execution domainsare provided. An exemplary computer-implemented method for providing acloud environment for provisioning a guest virtual machine instance caninclude steps of selecting at least one machine from a collection ofmachines as a management node, wherein the at least one machine includesa hypervisor enabled with nested virtualization capability, deploying aplurality of cloud managers on each management node, selecting at leastone machine from the collection of machines as a host node, deploying aplurality of level two hypervisors on each host node, forming aplurality of virtual clouds, wherein each virtual cloud contains atleast one of the plurality of cloud managers and one of the plurality oflevel two hypervisors, and provisioning, via the at least one cloudmanager, at least one guest virtual machine instance on top of the atleast one level two hypervisors.

Another aspect of the invention or elements thereof can be implementedin the form of an article of manufacture tangibly embodying computerreadable instructions which, when implemented, cause a computer to carryout a plurality of method steps, as described herein. Furthermore,another aspect of the invention or elements thereof can be implementedin the form of an apparatus including a memory and at least oneprocessor that is coupled to the memory and operative to perform notedmethod steps. Yet further, another aspect of the invention or elementsthereof can be implemented in the form of means for carrying out themethod steps described herein, or elements thereof; the means caninclude (i) hardware module(s), (ii) software module(s), or (iii) acombination of hardware and software modules; any of (i)-(iii) implementthe specific techniques set forth herein, and the software modules arestored in a tangible computer-readable storage medium (or multiple suchmedia).

These and other objects, features and advantages of the presentinvention will become apparent from the following detailed descriptionof illustrative embodiments thereof, which is to be read in connectionwith the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram illustrating cloud of virtual clouds (CVC)architecture, according to an embodiment of the present invention;

FIG. 2 is a diagram illustrating a malicious attack scenario, accordingto an embodiment of the present invention;

FIG. 3 is a diagram illustrating a cloud-as-a-service scenario,according to an embodiment of the present invention;

FIG. 4 is a flow diagram illustrating techniques for providing a cloudenvironment for provisioning a guest virtual machine instance, accordingto an embodiment of the invention; and

FIG. 5 is a system diagram of an exemplary computer system on which atleast one embodiment of the invention can be implemented.

DETAILED DESCRIPTION

As described herein, an aspect of the present invention includes a cloudof virtual clouds (CVC) for increased resilience and stable performance.At least one embodiment of the invention includes providing a cloudenvironment with diversified and isolated execution domains within asingle data center. Accordingly, unlike in disadvantageous existingapproaches, applications in each execution domain can failindependently, and therefore the resilience of the cloud is enhanced.Also, in at least one embodiment of the invention, the resourceallocation decisions can be made hierarchically, making it possible toprovide improved overall performance of an execution domain.

An aspect of the invention includes leveraging nested virtualizationtechniques to create multiple virtual clouds, and developing mechanismsto diversify the software stack used in each virtual cloud as well ascontrol the communications between virtual clouds. Compared to existingapproaches based on a single cloud, CVC enhances the cloud resilience.For example, a customer application replicated in multiple virtualclouds will be able to tolerate Byzantine failures, including bothcrashing failures, where a component stops working, and correctnessfailures, where a component keeps working but produces incorrect outputsin an arbitrary way.

Compared to existing approaches based on multiple virtual clouds, CVC ismore cost-efficient because only a single pool of physical resourcesneeds to be maintained and administrated. An aspect of the inventionalso includes enabling opportunities to maximize server utilization bymultiplexing different workload patterns. Moreover, CVC can enable acloud-as-a-service mode. In such a mode, the amount of physicalresources allocated to a virtual cloud can be strictly specified andenforced. Meanwhile, resource over-commitment is allowed within eachvirtual cloud.

FIG. 1 is a diagram illustrating cloud of virtual clouds (CVC)architecture, according to an embodiment of the present invention. Byway of illustration, FIG. 1 depicts a data center that includes a poolof physical hosts, such as host operation systems 116, 132 and 140.These hosts can operate in multiple virtual clouds, such as virtualcloud A 102 and virtual cloud B 118. An embodiment of the invention usesnested virtualization techniques to run a level 1 hypervisor (L1hypervisor) (such as components 114, 130 and 138 in FIG. 1) on eachhost. Multiple level 2 hypervisors (L2 hypervisor) can then commence oneach level 1 hypervisor. As depicted in FIG. 1, these include L2hypervisor A 108, L2 hypervisor B 110, L2 hypervisor A 122 and L2hypervisor B 128.

An aspect of the invention can include allowing multiple unmodifiedlevel 2 hypervisors, including kernel-based virtual machine (KVM) andVMware, to run on top of a single level 1 KVM hypervisor. After thelevel 2 hypervisors, multiple virtual clouds can be created (such as VMs104, 106, 112, 120, 124 and 126 in FIG. 1), each of which can use adifferent type of level 2 hypervisor and a different cloud manager. Asalso depicted in FIG. 1, cloud managers include cloud manager A 134 andcloud manager B 136. The level 2 hypervisors serve as compute hosts invirtual clouds.

Also, an embodiment of the invention includes developing intelligentmechanisms to allocate each virtual cloud on a set of physical hosts.Depending on the requirement for resilience, users can choose toreplicate individual applications with different replication degrees inmultiple virtual clouds. For each replicated application, allcommunications among its replicas, and from its replicas in CVC toexternal computers, can be encrypted and verified, for example, viaByzantine Fault Tolerance (BFT) consensus protocols.

By creating multiple virtual clouds and placing replicas of a customerapplication across them, at least one embodiment of the inventionlargely eliminates the possibility that a single attack through a guestapplication or guest operating system (OS) could propagate throughoutthe entire cloud environment and compromise other applications.Additionally, communications among virtual clouds can be verified tocontrol the propagation of malware, and outvote incorrect outputs.

FIG. 2 is a diagram illustrating a malicious attack scenario, accordingto an embodiment of the present invention. By way of illustration, FIG.2 depicts, similarly to FIG. 1, a data center that includes a pool ofphysical hosts, such as host operation systems 216 and 232. These hostscan operate in multiple virtual clouds, such as virtual cloud A 202 andvirtual cloud B 218. Nested virtualization techniques can be used to runa level 1 hypervisor (L1 hypervisor) (such as components 214 and 230) oneach host. Multiple level 2 hypervisors (L2 hypervisor) can commence oneach level 1 hypervisor. As depicted in FIG. 2, these include L2hypervisor A 208, L2 hypervisor B 210, L2 hypervisor A 222 and L2hypervisor B 228.

After the level 2 hypervisors, multiple virtual clouds can be created(such as VMs 204, 206, 212, 220, 224 and 226), each of which can use adifferent type of level 2 hypervisor. As also depicted in FIG. 2, it isassumed that there are two applications X and Y, both of which arereplicated in virtual clouds A and B with replicas X^(A) 242, X^(B) 246and Y^(A) 244, Y^(B) 248. If X^(A) is attacked, the attack could affectthe entire guest VM operating system and eventually the hypervisor. Thisis possible if there are multiple levels of vulnerabilities. Forexample, malicious code could become a user of the application throughcracking the password, gain root access to the guest OS by leveraging anOS buffer overflow, and enter the hypervisor space through a bug infunction call return.

If this happens, Y^(A) will also be compromised because it resides onthe affected hypervisor. However, in this example, the attack cannotstop the entire application Y from correctly functioning because Y^(B)runs on a different failure domain. Even if the attack takes control ofthe guest VM running application X, it cannot penetrate the level 2hypervisor in virtual cloud B, which is different from the level 2hypervisor in virtual cloud A.

FIG. 3 is a diagram illustrating a cloud-as-a-service scenario,according to an embodiment of the present invention. By way ofillustration, FIG. 3 depicts, similarly again to FIG. 1, a data centerthat includes a pool of physical hosts, such as host operation systems316 and 332. These hosts can operate in multiple virtual clouds, such asvirtual cloud A 302 and virtual cloud B 318. Nested virtualizationtechniques can be used to run a level 1 hypervisor (L1 hypervisor) (suchas components 314 and 330) on each host. Multiple level 2 hypervisors(L2 hypervisor) can commence on each level 1 hypervisor. As depicted inFIG. 3, these include L2 hypervisor A 308, L2 hypervisor B 310, L2hypervisor A 322 and L2 hypervisor B 328. After the level 2 hypervisors,multiple virtual clouds can be created (such as VMs 304, 306, 312, 320,324 and 326), each of which can use a different type of level 2hypervisor.

As also illustrated in the example depicted in FIG. 3, suppose that theentire physical cloud has two physical hosts, each with 16 centralprocessing unit (CPU) cores and 32 gigabytes (GB) of random accessmemory (RAM) main memory. Per user request, two virtual clouds can becreated: virtual cloud A with a total capacity of 14 cores and 28 GBmemory and virtual cloud B with a total capacity of 13 cores and 32 GBmemory. The allocation of the total amount of computing resource to eachvirtual cloud can be enforced at the L1 hypervisor layer, withmechanisms such as CPU core binding and memory region assignment. Forexample, on the left-most physical host in FIG. 3, L2 hypervisor A isallocated 10 cores and 20 GB of memory (as illustrated by component 352)and L2 hypervisor B is allocated 5 cores and 10 GB of memory (asillustrated by component 354). Also, on the right-most physical host inFIG. 3, L2 hypervisor A is allocated 4 cores and 8 GB of memory (asillustrated by component 356) and L2 hypervisor B is allocated 8 coresand 22 GB of memory (as illustrated by component 358).

Within each virtual cloud, resource over-commitment is allowed. Forexample, with the 10 cores and 20 GB memory allocated to it, L2hypervisor A 308 on the left-most physical host can serve 2 VMinstances, each requiring a size of 8 cores and 16 GB of memory (such asdepicted by VM 304 and VM 306).

As also detailed herein, on each physical host, an embodiment of theinvention can include enforcing a strict resource allocation policy. Oneexample embodiment of the invention can include physical segregation ofresources to improve performance isolation (CPU core binding, memoryregion allocation, etc.). Additionally, allocation policy on each hostcan change over time, with a low frequency. Further, in an embodiment ofthe invention, an entire L2 hypervisor unit can be migrated toconsolidate workload and increase server utilization.

FIG. 4 is a flow diagram illustrating techniques for providing a cloudenvironment for provisioning a guest virtual machine instance, accordingto an embodiment of the present invention. Step 402 includes selectingat least one machine from a collection of machines as a management node,wherein the at least one machine includes a hypervisor enabled withnested virtualization capability. Step 404 includes deploying aplurality of cloud managers on each management node. Step 406 includesselecting at least one machine from the collection of machines as a hostnode. Step 408 includes deploying a plurality of level two hypervisorson each host node. Step 410 includes forming a plurality of virtualclouds, wherein each virtual cloud contains at least one of theplurality of cloud managers and one of the plurality of level twohypervisors.

Step 412 includes provisioning, via the at least one cloud manager, atleast one guest virtual machine instance on top of the at least onelevel two hypervisors. Provisioning at least one guest virtual machineinstance on top of the at least one level two hypervisors can includeprovisioning per a request from a cloud user.

In an example embodiment of the invention, at least two different cloudmanagers and at least two different level two hypervisors are used.

Further, the techniques depicted in FIG. 4 can include deploying aninstance of a single application across each of the plurality of virtualclouds, as well as running a Byzantine Fault Tolerance (BFT) consensusprotocol among each application instance. The BFT protocol will run thesame copy of a computer program on multiple application instances andcompare the outputs from the multiple instances. The output is confirmedand presented to users only if at least a certain number of instanceshave reached an agreement. This guarantees the security of the programin face of malicious attacks; even if a malicious program hascompromised several instances, the user will get correct outputs as longas the majority of instances remain safe.

Aspects of the invention can additionally include controllingcommunication between the plurality of virtual clouds, and specifying anamount of physical resources allocated to each of the plurality ofvirtual clouds. At least one embodiment of the invention can alsoinclude enabling physical resource allocation modification on eachvirtual cloud (for example, over time).

Additionally, in accordance with at least one embodiment of theinvention, resource over-commitment is allowed within each virtualcloud, each virtual cloud can be allocated on a set of physical hosts.

The techniques depicted in FIG. 4 can also, as described herein, includeproviding a system, wherein the system includes distinct softwaremodules, each of the distinct software modules being embodied on atangible computer-readable recordable storage medium. All the modules(or any subset thereof) can be on the same medium, or each can be on adifferent medium, for example. The modules can include any or all of thecomponents shown in the figures. In an aspect of the invention, themodules can run, for example on a hardware processor. The method stepscan then be carried out using the distinct software modules of thesystem, as described above, executing on a hardware processor. Further,a computer program product can include a tangible computer-readablerecordable storage medium with code adapted to be executed to carry outat least one method step described herein, including the provision ofthe system with the distinct software modules.

Additionally, the techniques depicted in FIG. 4 can be implemented via acomputer program product that can include computer useable program codethat is stored in a computer readable storage medium in a dataprocessing system, and wherein the computer useable program code wasdownloaded over a network from a remote data processing system. Also, inan aspect of the invention, the computer program product can includecomputer useable program code that is stored in a computer readablestorage medium in a server data processing system, and wherein thecomputer useable program code is downloaded over a network to a remotedata processing system for use in a computer readable storage mediumwith the remote system.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present invention may take the form of acomputer program product embodied in a computer readable medium havingcomputer readable program code embodied thereon.

An aspect of the invention or elements thereof can be implemented in theform of an apparatus including a memory and at least one processor thatis coupled to the memory and operative to perform exemplary methodsteps.

Additionally, an aspect of the present invention can make use ofsoftware running on a general purpose computer or workstation. Withreference to FIG. 5, such an implementation might employ, for example, aprocessor 502, a memory 504, and an input/output interface formed, forexample, by a display 506 and a keyboard 508. The term “processor” asused herein is intended to include any processing device, such as, forexample, one that includes a CPU (central processing unit) and/or otherforms of processing circuitry. Further, the term “processor” may referto more than one individual processor. The term “memory” is intended toinclude memory associated with a processor or CPU, such as, for example,RAM (random access memory), ROM (read only memory), a fixed memorydevice (for example, hard drive), a removable memory device (forexample, diskette), a flash memory and the like. In addition, the phrase“input/output interface” as used herein, is intended to include, forexample, a mechanism for inputting data to the processing unit (forexample, mouse), and a mechanism for providing results associated withthe processing unit (for example, printer). The processor 502, memory504, and input/output interface such as display 506 and keyboard 508 canbe interconnected, for example, via bus 510 as part of a data processingunit 512. Suitable interconnections, for example via bus 510, can alsobe provided to a network interface 514, such as a network card, whichcan be provided to interface with a computer network, and to a mediainterface 516, such as a diskette or CD-ROM drive, which can be providedto interface with media 518.

Accordingly, computer software including instructions or code forperforming the methodologies of the invention, as described herein, maybe stored in an associated memory devices (for example, ROM, fixed orremovable memory) and, when ready to be utilized, loaded in part or inwhole (for example, into RAM) and implemented by a CPU. Such softwarecould include, but is not limited to, firmware, resident software,microcode, and the like.

A data processing system suitable for storing and/or executing programcode will include at least one processor 502 coupled directly orindirectly to memory elements 504 through a system bus 510. The memoryelements can include local memory employed during actual implementationof the program code, bulk storage, and cache memories which providetemporary storage of at least some program code in order to reduce thenumber of times code must be retrieved from bulk storage duringimplementation.

Input/output or I/O devices (including but not limited to keyboards 508,displays 506, pointing devices, and the like) can be coupled to thesystem either directly (such as via bus 510) or through intervening I/Ocontrollers (omitted for clarity).

Network adapters such as network interface 514 may also be coupled tothe system to enable the data processing system to become coupled toother data processing systems or remote printers or storage devicesthrough intervening private or public networks. Modems, cable modem andEthernet cards are just a few of the currently available types ofnetwork adapters.

As used herein, including the claims, a “server” includes a physicaldata processing system (for example, system 512 as shown in FIG. 5)running a server program. It will be understood that such a physicalserver may or may not include a display and keyboard.

As noted, aspects of the present invention may take the form of acomputer program product embodied in a computer readable medium havingcomputer readable program code embodied thereon. Also, any combinationof one or more computer readable medium(s) may be utilized. The computerreadable medium may be a computer readable signal medium or a computerreadable storage medium. A computer readable storage medium may be, forexample, but not limited to, an electronic, magnetic, optical,electromagnetic, infrared, or semiconductor system, apparatus, ordevice, or any suitable combination of the foregoing. More specificexamples (a non-exhaustive list) of the computer readable storage mediumwould include the following: an electrical connection having one or morewires, a portable computer diskette, a hard disk, a random access memory(RAM), a read-only memory (ROM), an erasable programmable read-onlymemory (EPROM or Flash memory), an optical fiber, a portable compactdisc read-only memory (CD-ROM), an optical storage device, a magneticstorage device, or any suitable combination of the foregoing. In thecontext of this document, a computer readable storage medium may be anytangible medium that can contain, or store a program for use by or inconnection with an instruction execution system, apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing an appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of at least oneprogramming language, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks. Accordingly, an aspect of the inventionincludes an article of manufacture tangibly embodying computer readableinstructions which, when implemented, cause a computer to carry out aplurality of method steps as described herein.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

The flowchart and block diagrams in the figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, component, segment,or portion of code, which comprises at least one executable instructionfor implementing the specified logical function(s). It should also benoted that, in some alternative implementations, the functions noted inthe block may occur out of the order noted in the figures. For example,two blocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

It should be noted that any of the methods described herein can includean additional step of providing a system comprising distinct softwaremodules embodied on a computer readable storage medium; the modules caninclude, for example, any or all of the components shown in FIG. 1. Themethod steps can then be carried out using the distinct software modulesand/or sub-modules of the system, as described above, executing on ahardware processor 502. Further, a computer program product can includea computer-readable storage medium with code adapted to be implementedto carry out at least one method step described herein, including theprovision of the system with the distinct software modules.

In any case, it should be understood that the components illustratedherein may be implemented in various forms of hardware, software, orcombinations thereof; for example, application specific integratedcircuit(s) (ASICS), functional circuitry, an appropriately programmedgeneral purpose digital computer with associated memory, and the like.Given the teachings of the invention provided herein, one of ordinaryskill in the related art will be able to contemplate otherimplementations of the components of the invention.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a,” “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition ofanother feature, integer, step, operation, element, component, and/orgroup thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below are intended toinclude any structure, material, or act for performing the function incombination with other claimed elements as specifically claimed. Thedescription of the present invention has been presented for purposes ofillustration and description, but is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the invention. Theembodiment was chosen and described in order to best explain theprinciples of the invention and the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiments with various modifications as are suited to theparticular use contemplated.

At least one aspect of the present invention may provide a beneficialeffect such as, for example, enhancing the resilience of a cloud byenabling applications in each of multiple execution domains to failindependently.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the describedembodiments. The terminology used herein was chosen to best explain theprinciples of the embodiments, the practical application or technicalimprovement over technologies found in the marketplace, or to enableothers of ordinary skill in the art to understand the embodimentsdisclosed herein.

What is claimed is:
 1. An article of manufacture comprising anon-transitory computer readable storage medium having computer readableinstructions tangibly embodied thereon which, when implemented, cause acomputer to carry out a plurality of method steps comprising: deployinga level one hypervisor enabled with nested virtualization capability oneach of multiple host operating systems running on plurality of hostnodes within a data center, wherein each of the multiple host operatingsystems operate in each of two or more virtual clouds, and wherein thetwo or more virtual clouds include two or more distinct cloud managers,wherein the two or more distinct cloud managers are deployed on a levelone hypervisor executing on a host operating system running on amanagement node; deploying a plurality of level two hypervisors on eachlevel one hypervisor deployed on each of multiple host operatingsystems; provisioning, via the two or more distinct cloud managerswithin the two or more virtual clouds, multiple guest virtual machineinstances of multiple guest virtual machine types on top of theplurality of level two hypervisors, wherein each of the plurality oflevel two hypervisors has at least one of the multiple guest virtualmachine instances provisioned thereon, thereby providing the cloudenvironment with multiple isolated execution domains within the datacenter; and deploying at least one application instance within each ofthe multiple guest virtual machine instances.
 2. The article ofmanufacture of claim 1, wherein said plurality of level two hypervisorscomprises at least two different types of level two hypervisors.
 3. Thearticle of manufacture of claim 1, wherein the computer readableinstructions which, when implemented, further cause a computer to carryout a method step comprising: deploying an instance of a singleapplication across each of the two or more virtual clouds.
 4. Thearticle of manufacture of claim 1, wherein the computer readableinstructions which, when implemented, further cause a computer to carryout a method step comprising: specifying an amount of physical resourcesallocated to each of the two or more virtual clouds.
 5. The article ofmanufacture of claim 1, wherein resource over-commitment is allowedwithin each of the two or more virtual clouds.
 6. The article ofmanufacture of claim 1, wherein said provisioning comprises provisioningper a request from a cloud user.
 7. The article of manufacture of claim1, wherein the computer readable instructions which, when implemented,further cause a computer to carry out a method step comprising: runninga Byzantine Fault Tolerance (BFT) consensus protocol among eachapplication instance.
 8. The article of manufacture of claim 1, whereinthe computer readable instructions which, when implemented, furthercause a computer to carry out a method step comprising: controllingcommunication between the two or more virtual clouds.
 9. A system forproviding a cloud environment for provisioning a guest virtual machineinstance, comprising: a memory; and at least one processor coupled tothe memory and operative for: deploying a level one hypervisor enabledwith nested virtualization capability on each of multiple host operatingsystems running on a plurality of host nodes within a data center,wherein each of the multiple host operating systems operate in each oftwo or more virtual clouds, and wherein the two or more virtual cloudsinclude two or more distinct cloud managers, wherein the two or moredistinct cloud managers are deployed on a level one hypervisor executingon a host operating system running on a management node; deploying aplurality of level two hypervisors on each level one hypervisor deployedon each of multiple host operating systems; provisioning, via the two ormore distinct cloud managers within the two or more virtual clouds,multiple guest virtual machine instances of multiple guest virtualmachine types on top of the plurality of level two hypervisors, whereineach of the plurality of level two hypervisors has at least one of themultiple guest virtual machine instances provisioned thereon, therebyproviding the cloud environment with multiple isolated execution domainswithin the data center; and deploying at least one application instancewithin each of the multiple quest virtual machine instances.
 10. Thesystem of claim 9, wherein said plurality of level two hypervisorscomprises at least two different types of level two hypervisors.
 11. Thesystem of claim 9, wherein the at least one processor coupled to thememory is further operative for: deploying an instance of a singleapplication across each of the two or more virtual clouds.
 12. Thesystem of claim 9, wherein the at least one processor coupled to thememory is further operative for: specifying an amount of physicalresources allocated to each of the two or more virtual clouds.
 13. Thesystem of claim 9, wherein resource over-commitment is allowed withineach of the two or more virtual clouds.
 14. The system of claim 9,wherein said provisioning comprises provisioning per a request from acloud user.
 15. The system of claim 9, wherein the at least oneprocessor coupled to the memory is further operative for: running aByzantine Fault Tolerance (BFT) consensus protocol among eachapplication instance.
 16. The system of claim 9, wherein the at leastone processor coupled to the memory is further operative for:controlling communication between the two or more virtual clouds.